Identity & Access Management
Top Stories
-
Tip
28 Jul 2026
CISO's guide to data obfuscation
With so many services requiring access to sensitive data, encryption alone is not enough. Data obfuscation has evolved into a core element of modern cybersecurity architecture. Continue Reading
-
Tip
24 Jul 2026
CISO's guide to privileged identity management
IAM is more crucial than ever in the AI era. To better control who -- and what -- is accessing systems and data, security teams need to move beyond standing access privileges. Continue Reading
-
Tip
09 Jul 2026
Common MFA mistakes -- and how to fix them
Attackers have adapted their techniques to circumvent an organization's MFA controls. When they succeed, it's usually because MFA wasn't properly set up or managed. Continue Reading
-
Tip
09 Jun 2026
Top identity and access management risks
Identity is long past the days of logging into systems. Security teams must now manage SaaS apps, AI agents and machine-to-machine interactions across distributed environments. Continue Reading
-
Opinion
22 May 2026
Identity security for AI agents: The proliferation challenge
Identity teams can accelerate AI adoption with strong security foundations. But managing nondeterministic AI agents is different from securing human identities and traditional NHIs. Continue Reading
-
Tip
07 May 2026
5 leading enterprise password managers to consider
Admins need their password managers to provide a wide range of features and capabilities. Learn what every password manager must have, along with available options. Continue Reading
-
Feature
01 May 2026
Top zero-trust use cases in the enterprise
When applied correctly, zero trust can minimize an organization's attack surface. Experts weigh in on the best use cases where zero trust can deliver results. Continue Reading
-
Tip
29 Apr 2026
What are the most common authentication methods?
To authenticate users, security teams have a range of options available. Note, however, that a combination of methods is the best and safest approach. Continue Reading
-
Tip
15 Apr 2026
How to roll out an enterprise passkey deployment
Passkey security sidesteps many of the end-user and cybersecurity issues that plague traditional passwords. Learn how to successfully deploy passkeys in your organization. Continue Reading
-
Tip
09 Apr 2026
8 best practices for a bulletproof IAM strategy
IAM systems enable secure access to applications and resources. But to benefit from IAM -- and avoid a security failure -- teams must know which best practices to follow. Continue Reading
-
Opinion
07 Apr 2026
Identity security at RSAC 2026: The new enterprise dynamics
Omdia analyst Todd Thiemann made the rounds at RSAC 2026 Conference, speaking with CISOs, practitioners and vendors to identify the latest shifts in identity and data security. Continue Reading
-
Tip
17 Mar 2026
Top UEBA use cases in enterprise cybersecurity
User and entity behavior analytics tools find patterns hidden in an ocean of data, making them critically important in cybersecurity. Explore key UEBA use cases in the enterprise. Continue Reading
-
Definition
21 Nov 2025
What is identity and access management? Guide to IAM
No longer just a good idea, IAM is a crucial piece of the cybersecurity puzzle. It's how an organization regulates access to information and meets its compliance obligations. Continue Reading
-
Opinion
19 Nov 2025
How to plan an IAM program strategy
More than half of organizations lack an IAM strategy. Discover how security leaders can build stakeholder-driven identity management programs that deliver results. Continue Reading
-
Tutorial
18 Nov 2025
How to use Hashcat to recover passwords
This tutorial and accompanying video on using Hashcat for ethical password recovery covers installation, hash types, dictionary attacks and rule variations for security testing. Continue Reading
-
Tip
22 Oct 2025
Top 7 password hygiene tips and best practices
Passwords enable users to access important accounts and data, making them attractive targets to attackers, too. Follow these password hygiene tips to keep your organization safe. Continue Reading
-
Opinion
07 Oct 2025
Identity security tool sprawl: Origins and the way forward
From IGA to ITDR, identity teams juggle diverse security functions. Explore how tool proliferation affects operations and consolidation strategies. Continue Reading
-
Opinion
20 Aug 2025
Identity and data security themes at Black Hat 2025
Read about the identity and data security happenings at Black Hat 2025, including advancements that enable AI adoption and products that help prepare for a post-quantum world. Continue Reading
-
Definition
18 Jul 2025
What is biometric authentication?
Biometric authentication is a security process that relies on the unique biological characteristics of individuals to verify their identity. Continue Reading
-
Video
17 Jul 2025
An explanation of identity and access management
Identity and access management systems safeguard businesses by controlling digital identities, managing access rights and implementing security protocols. Continue Reading
-
Feature
08 Jul 2025
How to implement zero trust: 7 expert steps
Zero trust means a lot more than determining how users access resources. Successful implementation takes time, commitment and ongoing support. Continue Reading
-
Definition
02 Jul 2025
What is a message authentication code (MAC)? How it works and best practices
A message authentication code (MAC) is a cryptographic checksum applied to a message to guarantee its integrity and authenticity. Continue Reading
-
Definition
02 Jul 2025
What is the principle of least privilege (POLP)?
The principle of least privilege (POLP) is a concept in computer security that limits users' access rights to only what is strictly required to do their jobs. Continue Reading
-
Opinion
26 Jun 2025
Top identity security themes at Identiverse 2025
Identiverse 2025 found security pros tackling nonhuman identity risks, preparing for agentic AI challenges and shifting from homegrown to commercial CIAM tools. Continue Reading
-
Definition
25 Jun 2025
What is Single Sign-On (SSO)? Definition, How It Works & Benefits
Single sign-on (SSO) is a session and user authentication service that lets users access multiple applications or systems with a single set of login credentials. Continue Reading
-
Tip
24 Jun 2025
Multifactor authentication: 5 examples and strategic use cases
Before implementing MFA, conduct a careful study to determine which security factors offer the strongest protection. Passwords and PINs aren't cutting it any longer. Continue Reading
-
Feature
16 Jun 2025
3 leading multifactor authentication tool providers
Compare top MFA providers Cisco, Okta and Ping Identity. Learn product features and pricing tiers, and get advice on selecting a product for your organization's security needs. Continue Reading
-
Definition
16 Jun 2025
What is HMAC (Hash-Based Message Authentication Code)?
Hash-based message authentication code (HMAC) is a message encryption method that uses a cryptographic key with a hash function. Continue Reading
-
Feature
06 Jun 2025
Why identity is the new perimeter – and how to defend it
Identity has replaced network boundaries as today's security perimeter. Organizations must focus on protecting digital identities to safeguard their assets. Continue Reading
-
Tip
03 Jun 2025
Account lockout policy: Setup and best practices explained
Organizations must carefully balance security and UX when implementing account lockout policies. Continue Reading
-
Definition
02 Jun 2025
What is a time-based one-time password?
A time-based one-time password (TOTP) is a temporary passcode generated by an algorithm that uses the current time of day as one of its authentication factors. Continue Reading
-
Tip
20 May 2025
How to create a remote access policy, with template
Remote work, while beneficial, presents numerous security risks. Help keep your organization's systems safe with a remote access policy. Continue Reading
-
Opinion
09 May 2025
RSAC 2025 Conference: Identity security highlights
RSAC 2025 Conference was abuzz with talk about agentic AI and tool convergence. Analyst Todd Thiemann shares how these trends affect identity security. Continue Reading
-
Definition
05 May 2025
What is a registration authority (RA)?
A registration authority (RA) is an entity that is authorized to verify user requests for a digital certificate and also to tell a certificate authority (CA) to issue that certificate to the user. Continue Reading
-
Tip
28 Apr 2025
How payment tokenization works and why it's important
Payment tokenization benefits merchants and customers alike. It not only helps protect financial transaction data, but also improves UX. Continue Reading
-
Tutorial
14 Apr 2025
How to create custom sudo configuration files in /etc/sudoers
Sudo offers administrators a lot of flexibility. Creating custom sudo configurations can go a long way toward easing management and service upgrade challenges. Continue Reading
-
Opinion
09 Apr 2025
Data security and identity security themes at RSAC 2025
Check out what Enterprise Strategy Group analyst Todd Thiemann has on his agenda for RSA Conference 2025. Continue Reading
-
Tip
01 Apr 2025
IAM compliance: Know the system controls at your disposal
IAM is critical to an organization's data security posture, and its role in regulatory compliance is just as crucial. Continue Reading
-
Tip
28 Mar 2025
How to create a strong passphrase, with examples
Passphrases have emerged as an effective way to protect networks from brute-force attacks. But users still need to know how to create a passphrase that's effective. Continue Reading
-
Tip
26 Mar 2025
Benefits and challenges of zero standing privileges
Zero standing privileges combines the zero-trust model with the principle of least privilege to strengthen privileged access management and reduce enterprise attack surfaces. Continue Reading
-
Definition
10 Mar 2025
What is Kerberos and how does it work?
Kerberos is a protocol for authenticating service requests between trusted hosts across an untrusted network, such as the internet. Continue Reading
-
Definition
07 Mar 2025
What is a certificate authority (CA)?
A certificate authority (CA) is a trusted entity that issues digital certificates to authenticate content sent from web servers. Continue Reading
-
Definition
28 Feb 2025
What is multifactor authentication?
Multifactor authentication (MFA) is an IT security technology that requires multiple sources of unique information from independent categories of credentials to verify a user's identity for a login or other transaction. Continue Reading
-
Definition
27 Feb 2025
What is federated identity management (FIM)? How does it work?
Federated identity management (FIM) is an arrangement between multiple enterprises or domains that enables their users to use the same identification data (digital identity) to access all their networks. Continue Reading
-
Feature
21 Feb 2025
How to build an effective IAM architecture
Identity and access management is changing and so must strategies for managing it. Read up on IAM architecture approaches and how to select the best for your organization. Continue Reading
-
Definition
19 Feb 2025
What is challenge-response authentication?
In computer security, challenge-response authentication is a set of protocols used to protect digital assets and services from unauthorized users, programs and activities. Continue Reading
-
News
12 Feb 2025
Fortinet discloses second authentication bypass vulnerability
Fortinet disclosed CVE-2025-24472 in an updated advisory that confused some in the infosec community because it stated that 'reports show this is being exploited in the wild.' Continue Reading
-
Tip
11 Feb 2025
Benefits and challenges of passkeys in the enterprise
Passkeys overcome some of the critical security vulnerabilities plaguing passwords. But enterprises face some new challenges when deploying the authentication technology. Continue Reading
-
Definition
11 Feb 2025
What is privileged access management (PAM)?
Privileged access management (PAM) is a security framework designed to protect organizations against cyberthreats by controlling and monitoring access to critical information and resources. Continue Reading
-
Definition
11 Feb 2025
What is the RSA algorithm?
The RSA algorithm (Rivest-Shamir-Adleman) is a public key cryptosystem that uses a pair of keys for securing digital communication and transactions over insecure networks, such as the internet. Continue Reading
-
Answer
07 Feb 2025
7 key identity and access management benefits
Identity and access management benefits users, security and IT admins, and it also improves an organization's security posture. Read up on seven key advantages of IAM. Continue Reading
-
Tip
05 Feb 2025
Comparing top identity and access management certifications
Holding an identity and access management certification demonstrates knowledge of security fundamentals, plus it can yield rewarding career and networking opportunities. Continue Reading
-
Definition
31 Jan 2025
What is a certificate revocation list (CRL) and how is it used?
A certificate revocation list (CRL) is a list of digital certificates that have been revoked by the issuing certificate authority (CA) before their actual or assigned expiration date. Continue Reading
-
Definition
31 Jan 2025
What is biometric verification?
Biometric verification is any means by which a person can be uniquely identified by evaluating one or more distinguishing biological traits. Continue Reading
-
Definition
31 Jan 2025
What is biometrics?
Biometrics is the measurement and statistical analysis of people's unique physical and behavioral characteristics. Continue Reading
-
Definition
30 Jan 2025
What is a password?
A password is a string of characters used to verify the identity of a user during the authentication process. Continue Reading
-
Definition
24 Jan 2025
What is SAML (Security Assertion Markup Language)?
Security Assertion Markup Language (SAML) is an open standard for sharing security information about identity, authentication and authorization across different systems. Continue Reading
-
Opinion
03 Jan 2025
The basics drive 2025 identity security investments
New identity security tech might steal headlines, but Informa TechTarget's Enterprise Strategy Group analyst Todd Thiemann shows the basics get the most attention from businesses. Continue Reading
-
Feature
20 Dec 2024
Identity and access management tools and features for 2025
The IAM tool marketplace is complex and ever-changing. Learn about key features and how to discern what your organization needs before approaching potential providers. Continue Reading
-
Definition
19 Dec 2024
What is a public key certificate?
A public key certificate is a digitally signed document that serves to validate the sender's authorization and name. Continue Reading
-
Tip
17 Dec 2024
Are password managers safe for enterprise use?
Password managers have benefits, but they are also subject to attacks that can put organizations at substantial risk. So, are they safe? Continue Reading
-
Tip
17 Dec 2024
The pros and cons of biometric authentication
Biometric authentication can be a solid supplement to passwords when securing data and systems. But understanding potential drawbacks, and planning to minimize them, is essential. Continue Reading
-
Definition
17 Dec 2024
What is passwordless authentication?
Passwordless authentication allows a user to sign into a service without using a password. This is often done using certificates, security tokens, one-time passwords (OTPs) or biometrics. Continue Reading
-
Definition
17 Dec 2024
What is PKI (public key infrastructure)?
PKI (public key infrastructure) is the underlying framework that enables the secure exchange of information over the internet using digital certificates and public key encryption. Continue Reading
-
Tip
12 Dec 2024
9 identity and access management trends to watch in 2025
Identity threats continue to change and so, too, do the defenses developed to address those security challenges. Be ready for what's coming next in IAM. Continue Reading
-
Tip
12 Dec 2024
7 must-know IAM standards in 2025
Does your IAM program need OAuth or OpenID Connect? Or maybe both? Let's look at the various standards and protocols that make identity management function. Continue Reading
-
Opinion
12 Dec 2024
Nonhuman identity security is getting board-level attention
Has your organization addressed nonhuman identity security? NHI attacks are becoming more prevalent and need to be a part of enterprise security strategies. Continue Reading
-
Definition
09 Dec 2024
What is user authentication?
User authentication refers to the process of verifying the identity of a user attempting to gain access to a computer network, system or device. This process runs in the background and can be done through different means, such as asking the user to enter a password, provide a PIN or provide a fingerprint. Continue Reading
-
Definition
09 Dec 2024
What is a session key?
A session key is an encryption and decryption key that is randomly generated to ensure the security of a communications session between a user and another computer or between two computers. Continue Reading
-
Opinion
05 Dec 2024
2025 identity security and data security predictions
From securing nonhuman identities to post-quantum cryptography to DSPM and DLP combining, here's what's in store for identity and data security in 2025. Continue Reading
-
Tip
20 Nov 2024
4 types of access control
Access management is the gatekeeper, making sure a device or person can gain entry only to the systems or applications to which they have been granted permission. Continue Reading
-
Tip
20 Nov 2024
User provisioning and deprovisioning: Why it matters for IAM
Overprivileged and orphaned user identities pose risks. Cybersecurity teams should be sure user profiles grant only appropriate access -- and only for as long as necessary. Continue Reading
-
Tip
19 Nov 2024
What skills are needed for a successful career in IAM?
In the zero-trust era, identity management is critical to an organization's cybersecurity posture. What skills are required to transition into a career in IAM? Continue Reading
-
News
15 Nov 2024
MFA required for AWS Organizations member accounts in 2025
AWS is one of several cloud providers that will implement MFA requirements over the next year, with other relevant names including Google Cloud and Microsoft Azure. Continue Reading
-
Definition
14 Nov 2024
What is identity governance and administration (IGA)?
Identity governance and administration (IGA) is the collection of processes and practices used to manage user digital identities and their access throughout the enterprise. Continue Reading
-
Answer
12 Nov 2024
Identity management vs. authentication: Know the difference
Learn how authentication and identity management are both intrinsic to an identity and access management framework. Learn how they differ and the role each one plays. Continue Reading
-
Definition
06 Nov 2024
What is machine identity management?
Machine identity management focuses on the machines connected to and accessing resources on a network. Continue Reading
-
News
05 Nov 2024
Google Cloud to roll out mandatory MFA for all users
Google's three-phase plan for mandatory MFA, which will culminate in late 2025, follows similar efforts from other cloud providers such as AWS and Microsoft. Continue Reading
-
Definition
28 Oct 2024
What is two-factor authentication (2FA)?
Two-factor authentication (2FA), sometimes referred to as two-step verification or dual-factor authentication, is a security process in which users provide two different authentication factors to verify themselves. Continue Reading
-
Definition
28 Oct 2024
What is authentication, authorization and accounting (AAA)?
Authentication, authorization and accounting (AAA) is a security framework for controlling and tracking user access within a computer network. Continue Reading
-
News
24 Oct 2024
Cisco ASA and FTD zero day used in password spraying attacks
One day after Cisco disclosed a zero-day vulnerability discovered in its VPN software, CISA added the flaw to its Known Exploited Vulnerabilities catalog. Continue Reading
-
News
15 Oct 2024
FIDO unveils new specifications to transfer passkeys
The proposed FIDO Alliance specifications would enable users and organizations to securely transfer credentials from one identity provider to another. Continue Reading
-
Definition
27 Sep 2024
What is access control?
Access control is a security technique that regulates who or what can view or use resources in a computing environment. Continue Reading
-
Definition
06 Sep 2024
What is identity threat detection and response (ITDR)?
Identity threat detection and response (ITDR) is a collection of tools and best practices aimed at defending against cyberattacks that specifically target user identities or identity and access management (IAM) infrastructure. Continue Reading
-
Tip
22 Aug 2024
How frictionless authentication works in online payments
Online retailers face a challenge: Make the payment process quick and easy for legitimate customers but not for fraudsters. Frictionless authentication can help. Continue Reading
-
News
19 Aug 2024
Microsoft to roll out mandatory MFA for Azure
Following several high-profile attacks across the globe on MFA-less accounts, Microsoft will make the security measure mandatory for Azure sign-ins beginning in October. Continue Reading
-
Tip
12 Aug 2024
How invisible MFA works to reduce UX friction
Traditional MFA provides benefits but tests users' patience. Explore how invisible MFA can make it easier to access resources and reduce MFA fatigue. Continue Reading
-
News
15 Jul 2024
Experts weigh in on Snowflake database MFA features
In response to a wave of recent attacks on customers, Snowflake introduces new authentication offerings that enable administrators to require MFA for all user accounts. Continue Reading
-
Tip
09 Jul 2024
Use these 6 user authentication types to secure networks
One layer of security that all networks and applications need is authentication. Read up on six authentication types, from 2FA to biometrics to certificates. Continue Reading
-
Definition
25 Jun 2024
digital signature
A digital signature is a mathematical technique used to validate the authenticity and integrity of a digital document, message or software. Continue Reading
-
News
20 Jun 2024
How Amazon's decision to ditch Active Directory paid off
Amazon's decision to build its own identity and access management system was an expensive one, but an infamous supply chain attack validated the move. Continue Reading
-
Tip
17 Jun 2024
How deepfakes threaten biometric security controls
Biometric security controls are under attack by deepfakes -- convincing images, videos and audio created by generative AI. But all is not lost. Learn how to mitigate the risk. Continue Reading
-
Opinion
12 Jun 2024
Identiverse 2024: Key takeaways in identity security
The 2024 Identiverse conference addressed identity access management challenges, AI's ability to streamline IAM workflows and nonhuman identity management for identity pros. Continue Reading
-
News
10 Jun 2024
Mandiant: 'Exposed credentials' led to Snowflake attacks
According to new threat research, Mandiant is reporting that UNC5537 conducted attacks against Snowflake database customers at least as early as April 14. Continue Reading
-
Tip
10 Jun 2024
Why it's SASE and zero trust, not SASE vs. zero trust
When it comes to adopting SASE or zero trust, it's not a question of either/or, but using SASE to establish and enable zero-trust network access. Continue Reading
-
Answer
30 May 2024
Top 6 benefits of zero-trust security for businesses
The zero-trust security model demands infosec leaders take a holistic approach to IT infrastructure security. Learn about the top six business benefits of zero trust here. Continue Reading
-
Definition
15 May 2024
out-of-band authentication
Out-of-band authentication is a type of two-factor authentication (2FA) that requires a secondary verification method through a separate communication channel along with the typical ID and password. Continue Reading
-
Tutorial
07 May 2024
How to configure sudo privilege and access control settings
Learn how to use the sudo command for access control configurations, from granting full administrative privileges to delegating roles. Continue Reading
-
Definition
02 May 2024
What is role-based access control (RBAC)?
Role-based access control (RBAC) is a method of restricting network access based on the roles of individual users within an enterprise. Continue Reading
-
Tip
24 Apr 2024
Traditional MFA isn't enough, phishing-resistant MFA is key
Not every MFA technique is effective in combating phishing attacks. Enterprises need to consider new approaches to protect end users from fraudulent emails. Continue Reading
-
Feature
18 Apr 2024
3 Keycloak authorization strategies to secure app access
Keycloak, an open source IAM tool, offers authorization methods, including RBAC, GBAC and OAuth 2.0, that limit what users can access. Continue Reading
-
Opinion
18 Apr 2024
Optimize encryption and key management in 2024
Enterprise Strategy Group research highlighted the encryption challenges enterprises face, including lack of encryption, cryptographic infrastructure inadequacies and more. Continue Reading